Texas Sues Sony BMG Over CD 'Rootkit' Software

AUSTIN, Texas – The state sued Sony BMG Music Entertainment on Monday under its new anti-spyware law, saying anti-piracy technology the company slipped into music CDs leaves huge security holes on consumers' computers.

The lawsuit is over the so-called XCP technology that Sony had added to more than 50 CDs to restrict to three the number of times a single disc could be copied.

After a storm of criticism, Sony recalled the discs last week.

To enforce the restrictions, the CD automatically installed the copy-protection program when discs were put into a PC — a necessary step for transferring music to iPods and other portable music players.

Attorney General Greg Abbott accused Sony BMG of surreptitiously installing "spyware" in the form of files that mask other files Sony installed as part of XCP.

This "cloaking" component can leave computers vulnerable to viruses and other security problems, said Abbott, echoing the findings of computer security researchers.

"Sony has engaged in a technological version of cloak-and-dagger deceit against consumers by hiding secret files on their computers," Abbott said in a statement.

The term "spyware" has been used broadly to cover programs that are installed without users' full knowledge and consent, whether or not they actually spy on a user's activities.

A Sony BMG spokesman didn't immediately return a call Monday morning.

Sony BMG initially rejected the uproar over XCP as technobabble. But after security experts discovered that XCP opened gaping security holes in users' computers — as did the method Sony BMG offered for removing XCP — Sony BMG agreed last week to recall the discs.

Some 4.7 million had been made and 2.1 million sold. CDs that had XCP included releases by Van Zant, The Bad Plus, Neil Diamond and Celine Dion.

Abbott said some CDs remained in Texas stores as of Monday morning.

The Texas spyware law allows the state to recover damages of up to $100,000 in damages for each violation.

Abbott said there were thousands of violations, and that any money would go to the state.